github.com/aswedchain/aswed@v1.0.1/crypto/bls12381/swu.go (about)

     1  // Copyright 2020 The go-ethereum Authors
     2  // This file is part of the go-ethereum library.
     3  //
     4  // The go-ethereum library is free software: you can redistribute it and/or modify
     5  // it under the terms of the GNU Lesser General Public License as published by
     6  // the Free Software Foundation, either version 3 of the License, or
     7  // (at your option) any later version.
     8  //
     9  // The go-ethereum library is distributed in the hope that it will be useful,
    10  // but WITHOUT ANY WARRANTY; without even the implied warranty of
    11  // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    12  // GNU Lesser General Public License for more details.
    13  //
    14  // You should have received a copy of the GNU Lesser General Public License
    15  // along with the go-ethereum library. If not, see <http://www.gnu.org/licenses/>.
    16  
    17  package bls12381
    18  
    19  // swuMapG1 is implementation of Simplified Shallue-van de Woestijne-Ulas Method
    20  // follows the implmentation at draft-irtf-cfrg-hash-to-curve-06.
    21  func swuMapG1(u *fe) (*fe, *fe) {
    22  	var params = swuParamsForG1
    23  	var tv [4]*fe
    24  	for i := 0; i < 4; i++ {
    25  		tv[i] = new(fe)
    26  	}
    27  	square(tv[0], u)
    28  	mul(tv[0], tv[0], params.z)
    29  	square(tv[1], tv[0])
    30  	x1 := new(fe)
    31  	add(x1, tv[0], tv[1])
    32  	inverse(x1, x1)
    33  	e1 := x1.isZero()
    34  	one := new(fe).one()
    35  	add(x1, x1, one)
    36  	if e1 {
    37  		x1.set(params.zInv)
    38  	}
    39  	mul(x1, x1, params.minusBOverA)
    40  	gx1 := new(fe)
    41  	square(gx1, x1)
    42  	add(gx1, gx1, params.a)
    43  	mul(gx1, gx1, x1)
    44  	add(gx1, gx1, params.b)
    45  	x2 := new(fe)
    46  	mul(x2, tv[0], x1)
    47  	mul(tv[1], tv[0], tv[1])
    48  	gx2 := new(fe)
    49  	mul(gx2, gx1, tv[1])
    50  	e2 := !isQuadraticNonResidue(gx1)
    51  	x, y2 := new(fe), new(fe)
    52  	if e2 {
    53  		x.set(x1)
    54  		y2.set(gx1)
    55  	} else {
    56  		x.set(x2)
    57  		y2.set(gx2)
    58  	}
    59  	y := new(fe)
    60  	sqrt(y, y2)
    61  	if y.sign() != u.sign() {
    62  		neg(y, y)
    63  	}
    64  	return x, y
    65  }
    66  
    67  // swuMapG2 is implementation of Simplified Shallue-van de Woestijne-Ulas Method
    68  // defined at draft-irtf-cfrg-hash-to-curve-06.
    69  func swuMapG2(e *fp2, u *fe2) (*fe2, *fe2) {
    70  	if e == nil {
    71  		e = newFp2()
    72  	}
    73  	params := swuParamsForG2
    74  	var tv [4]*fe2
    75  	for i := 0; i < 4; i++ {
    76  		tv[i] = e.new()
    77  	}
    78  	e.square(tv[0], u)
    79  	e.mul(tv[0], tv[0], params.z)
    80  	e.square(tv[1], tv[0])
    81  	x1 := e.new()
    82  	e.add(x1, tv[0], tv[1])
    83  	e.inverse(x1, x1)
    84  	e1 := x1.isZero()
    85  	e.add(x1, x1, e.one())
    86  	if e1 {
    87  		x1.set(params.zInv)
    88  	}
    89  	e.mul(x1, x1, params.minusBOverA)
    90  	gx1 := e.new()
    91  	e.square(gx1, x1)
    92  	e.add(gx1, gx1, params.a)
    93  	e.mul(gx1, gx1, x1)
    94  	e.add(gx1, gx1, params.b)
    95  	x2 := e.new()
    96  	e.mul(x2, tv[0], x1)
    97  	e.mul(tv[1], tv[0], tv[1])
    98  	gx2 := e.new()
    99  	e.mul(gx2, gx1, tv[1])
   100  	e2 := !e.isQuadraticNonResidue(gx1)
   101  	x, y2 := e.new(), e.new()
   102  	if e2 {
   103  		x.set(x1)
   104  		y2.set(gx1)
   105  	} else {
   106  		x.set(x2)
   107  		y2.set(gx2)
   108  	}
   109  	y := e.new()
   110  	e.sqrt(y, y2)
   111  	if y.sign() != u.sign() {
   112  		e.neg(y, y)
   113  	}
   114  	return x, y
   115  }
   116  
   117  var swuParamsForG1 = struct {
   118  	z           *fe
   119  	zInv        *fe
   120  	a           *fe
   121  	b           *fe
   122  	minusBOverA *fe
   123  }{
   124  	a:           &fe{0x2f65aa0e9af5aa51, 0x86464c2d1e8416c3, 0xb85ce591b7bd31e2, 0x27e11c91b5f24e7c, 0x28376eda6bfc1835, 0x155455c3e5071d85},
   125  	b:           &fe{0xfb996971fe22a1e0, 0x9aa93eb35b742d6f, 0x8c476013de99c5c4, 0x873e27c3a221e571, 0xca72b5e45a52d888, 0x06824061418a386b},
   126  	z:           &fe{0x886c00000023ffdc, 0x0f70008d3090001d, 0x77672417ed5828c3, 0x9dac23e943dc1740, 0x50553f1b9c131521, 0x078c712fbe0ab6e8},
   127  	zInv:        &fe{0x0e8a2e8ba2e83e10, 0x5b28ba2ca4d745d1, 0x678cd5473847377a, 0x4c506dd8a8076116, 0x9bcb227d79284139, 0x0e8d3154b0ba099a},
   128  	minusBOverA: &fe{0x052583c93555a7fe, 0x3b40d72430f93c82, 0x1b75faa0105ec983, 0x2527e7dc63851767, 0x99fffd1f34fc181d, 0x097cab54770ca0d3},
   129  }
   130  
   131  var swuParamsForG2 = struct {
   132  	z           *fe2
   133  	zInv        *fe2
   134  	a           *fe2
   135  	b           *fe2
   136  	minusBOverA *fe2
   137  }{
   138  	a: &fe2{
   139  		fe{0, 0, 0, 0, 0, 0},
   140  		fe{0xe53a000003135242, 0x01080c0fdef80285, 0xe7889edbe340f6bd, 0x0b51375126310601, 0x02d6985717c744ab, 0x1220b4e979ea5467},
   141  	},
   142  	b: &fe2{
   143  		fe{0x22ea00000cf89db2, 0x6ec832df71380aa4, 0x6e1b94403db5a66e, 0x75bf3c53a79473ba, 0x3dd3a569412c0a34, 0x125cdb5e74dc4fd1},
   144  		fe{0x22ea00000cf89db2, 0x6ec832df71380aa4, 0x6e1b94403db5a66e, 0x75bf3c53a79473ba, 0x3dd3a569412c0a34, 0x125cdb5e74dc4fd1},
   145  	},
   146  	z: &fe2{
   147  		fe{0x87ebfffffff9555c, 0x656fffe5da8ffffa, 0x0fd0749345d33ad2, 0xd951e663066576f4, 0xde291a3d41e980d3, 0x0815664c7dfe040d},
   148  		fe{0x43f5fffffffcaaae, 0x32b7fff2ed47fffd, 0x07e83a49a2e99d69, 0xeca8f3318332bb7a, 0xef148d1ea0f4c069, 0x040ab3263eff0206},
   149  	},
   150  	zInv: &fe2{
   151  		fe{0xacd0000000011110, 0x9dd9999dc88ccccd, 0xb5ca2ac9b76352bf, 0xf1b574bcf4bc90ce, 0x42dab41f28a77081, 0x132fc6ac14cd1e12},
   152  		fe{0xe396ffffffff2223, 0x4fbf332fcd0d9998, 0x0c4bbd3c1aff4cc4, 0x6b9c91267926ca58, 0x29ae4da6aef7f496, 0x10692e942f195791},
   153  	},
   154  	minusBOverA: &fe2{
   155  		fe{0x903c555555474fb3, 0x5f98cc95ce451105, 0x9f8e582eefe0fade, 0xc68946b6aebbd062, 0x467a4ad10ee6de53, 0x0e7146f483e23a05},
   156  		fe{0x29c2aaaaaab85af8, 0xbf133368e30eeefa, 0xc7a27a7206cffb45, 0x9dee04ce44c9425c, 0x04a15ce53464ce83, 0x0b8fcaf5b59dac95},
   157  	},
   158  }